Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/engine/sanitization.py`:
- Around line 10-20: sanitize_message() currently only uses _PATH_PATTERN and
_URL_PATTERN and misses plain credentials (e.g., api_key=, token=, password=,
Authorization: Bearer) — add one or more credential regexes (e.g., for key=value
query/header forms and Authorization: Bearer/.+ and Bearer tokens in
URLs/headers) and apply them in sanitize_message() after/_alongside
_PATH_PATTERN/_URL_PATTERN to replace matches with a consistent placeholder like
"<REDACTED_CREDENTIAL>"; update/remove overlaps with _URL_PATTERN as needed to
avoid double-redaction and ensure functions/classes referenced (_PATH_PATTERN,
_URL_PATTERN, sanitize_message) handle headers, query params, and inline tokens.
- Around line 8-9: The module src/synthorg/engine/sanitization.py is missing the
standard module logger; add the required import and logger initialization by
importing get_logger from synthorg.observability and creating logger =
get_logger(__name__) at module scope so the module follows the convention used
across synthorg; place the import alongside existing imports (e.g., next to
import re) and define logger = get_logger(__name__) near the top of the file.

In `@tests/unit/engine/compaction/test_summarizer.py`:
- Around line 241-313: Add a regression test that verifies snippet truncation
cannot leak a partial path prefix: create a new async test (e.g.
test_assistant_snippet_truncation_does_not_leak_path_prefix) that uses the same
CompactionConfig and make_compaction_callback setup as the existing tests, then
build messages with a very long assistant content where a full path (e.g.
"C:\\Users\\dev\\project\\secrets.yaml") begins just before the 100-char snippet
boundary so truncation would have previously exposed a partial prefix; call
_build_context and the callback, then assert the resulting summary
message.content does not contain any partial path fragment like "C:\\Users" or
the original filename and that "[REDACTED_PATH]" appears instead; reuse symbols
_msg, _build_context, CompactionConfig, make_compaction_callback and the
sample_agent_with_personality fixture so the test matches the existing pattern.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/engine/sanitization.py`:
- Around line 50-52: The code raises ValueError for an invalid max_length but
doesn't log the error; before raising, call the module logger (e.g.,
logger.warning or logger.error) to record the invalid-input with context
including the provided max_length and any relevant function name (reference the
max_length check and msg variable in sanitization.py), then raise the same
ValueError; ensure you import or use the existing logger instance in the module
and include a clear message like "invalid max_length" plus the max_length value.

In `@tests/unit/engine/checkpoint/test_resume.py`:
- Around line 128-167: Combine the two nearly identical tests
test_error_with_path_is_sanitized and test_error_with_url_is_sanitized into a
single parametrized test using pytest.mark.parametrize: keep the shared setup
using _make_ctx_json and deserialize_and_reconcile (referencing AgentIdentity
and Task fixtures), and parametrize the error_message input and expected
redaction token (e.g., ("Failed at
C:\\Users\\dev\\secret.key","[REDACTED_PATH]") and ("Timeout calling
https://api.internal.io/v1/completions","[REDACTED_URL]")), then assert the
redaction appears and the raw substring (like "C:\\Users" or "https://") does
not appear; ensure the new test keeps the same agent_id/task_id and checks
last_msg.content as before.

In `@tests/unit/engine/compaction/test_summarizer.py`:
- Around line 241-314: Combine the two near-duplicate tests
test_assistant_snippet_with_path_is_sanitized and
test_assistant_snippet_with_url_is_sanitized into a single parametrized test
using pytest.mark.parametrize: iterate over tuples like (assistant_text,
forbidden_substring, expected_redaction) and reuse the same setup
(CompactionConfig, make_compaction_callback, _build_context, _msg, MessageRole)
inside the test body; assert that forbidden_substring is not in
summary_msg.content and expected_redaction is present. Keep the same
capacity/fill/preserve parameters and preserve_recent_turns, and name the new
test to reflect both cases (e.g.,
test_assistant_snippet_sanitization_parametrized).

In `@tests/unit/engine/test_sanitization.py`:
- Around line 216-222: Add a unit test that exercises sanitize_message's
redaction-expansion edge case: construct input where a short redactable pattern
(e.g., a path like "/ab") falls right before the truncate boundary used by
test_default_max_length/test_custom_max_length (use max_length=200) so that the
replacement token (e.g., "[REDACTED_PATH]") can expand past the limit; call
sanitize_message(raw, max_length=200), assert the redaction token appears in the
result and allow the length to exceed 200 as documented. Reference
sanitize_message and reuse the existing test naming style (e.g.,
test_redaction_near_boundary_may_exceed_max_length) so the new test is
discoverable alongside test_default_max_length and test_custom_max_length.

---

Duplicate comments:
In `@src/synthorg/engine/sanitization.py`:
- Around line 8-9: This module is missing the required module logger: add the
import "from synthorg.observability import get_logger" at top of
src/synthorg/engine/sanitization.py and initialize "logger =
get_logger(__name__)" at module scope so business-logic in this file uses the
standard get_logger and logger symbols.
- Around line 10-29: sanitize_message currently only strips paths/URLs via
_PATH_PATTERN/_URL_PATTERN but doesn't redact inline credentials or bearer
tokens; add one or more regex patterns to match common secrets (e.g.,
query/key-value pairs like api_key=..., access_token=..., token=...,
password=..., secret=..., auth=..., passwd=...), Authorization headers with
"Bearer <token>" and header-style "Authorization:Bearer ..." and include them in
the sanitizer pipeline so matches are replaced with a stable placeholder like
"[REDACTED]"; update sanitize_message to apply these new credential patterns
(after or alongside _URL_PATTERN) and ensure functions/variables mentioned
(_PATH_PATTERN, _URL_PATTERN, sanitize_message) are the points to modify so any
matched secrets are redacted before returning the message.